Security
Security hardening guide
Practical deployment guidance and explicit 2.0.0 limitations.
Public Internet exposure is unsupported. Keep Portivo behind management-network controls.
Minimum deployment checklist
- Generate a long random
APP_SECRET_KEY. - Restrict TCP 8766 to the exact management subnets that require access.
- Use HTTPS through a trusted reverse proxy for browser paths that are not physically/administratively isolated.
- Set
PUBLIC_URL_SCHEME=httpsbehind TLS termination. - Enable
TRUST_PROXY_HEADERSonly for explicit trusted proxy IPs. - Back up
portivo.dband the matching application secret. - Use least-privilege network accounts and role scopes.
- Use SHA-256/AES SNMPv3 where device compatibility permits it. Treat SHA/DES as legacy modes.
- Review release dependencies and checksums before deployment.
Current limitations to account for
- The default application bind remains
0.0.0.0:8766with HTTP. - Windows LAN-access behavior can open Domain, Private and Public firewall profiles when enabled.
- The current source does not document persistent SSH host-key fingerprint pinning as a Portivo control.
- The current Windows service packaging should be reviewed against your least-privilege host policy.
Recommended segmentation
Place Portivo on an administrative server/network with reachability to managed switch SSH and UPS SNMPv3 interfaces but with browser ingress restricted to authorized IT subnets. Avoid using a general user LAN as the management plane.
Source-backed detail
Production hardening checklist
- Generate a long unique application secret before first production start.
- Terminate TLS at a maintained reverse proxy and set the public URL scheme to HTTPS.
- Enable forwarded-header trust only for exact proxy addresses.
- Restrict ingress to administrative networks; never publish TCP 8766 directly.
- Use least-privilege roles, narrow Site/Group scope and separate automation credentials.
- Establish SSH host-key trust and review changes deliberately.
- Back up the database, protect backups as secrets and test restore.
- Keep the exact locked dependencies and validate installer/runtime hashes.
- Review sessions, failed authentication, Jobs, Audit Log and notification delivery.
Supply-chain baseline
The packaged installers use an exact dependency lock and verified upstream artifacts. Windows runtime and service-wrapper downloads are hash checked, Python Authenticode failure is fail-closed, and the Linux service uses a restricted systemd sandbox. Preserve these controls when repackaging.